Tunnelka buuxa ee OpenVPN wuxuu jaraa fadhigaaga SSH: hagaaji wadada jawaabta

Daarida macmiil OpenVPN tunnel buuxa leh mishiin aad SSH ku gaarto waxay jari kartaa fadhiga hal ilbiriqsi gudahiis, mishiinkuna wax qaldan ma sameeyo. Tunnelku ma beddelo sida baakaduhu u gaaraan serverka; wuxuu beddelaa sida jawaabahu u baxaan. Isla markii wadada caadiga ah ay tilmaanto tun0, jawaabta macmiilkaaga SSH waxay gashaa shabakadda bixiyaha, oo aan lahayn waddo ku noqota cinwaankaaga. Xidhiidhku wuu lalmaadayaa, isku dayga xigga wuu waqti dhaafayaa, daemonkuna wuxuu had iyo jeer dhagaysanayaa dekedda 22.

Akhri shaxda marinka ka hor inta aadan akhrin logga VPN. Loggu wuxuu odhan doonaa tunnelku wuu soo baxay, waana sax. Su'aashu waa interface-ka ay jawaab kastaa u gudubto, taasna waa raadin baakad kasta oo ku jirta shaxda uu tunnelku hadda dib u qoray.

Sababta jawaabtu uga baxdo albaabka qaldan

Baakadaha soo galaya weli waxay yimaadaan interface-ka jireed, sababtoo ah macmiil VPN ma beddeli karo sida internetku u gaaro cinwaanka dadweynaha ee serverkaaga. Jawaabahu waa go'aan gaar ah: baakad kasta, kernelku wuxuu raadiyaa meesha loo socdo, iyo ka dib --redirect-gateway qoraalka caadiga ahi wuxuu yidhaahdaa tunnel. Meesha bixiyaha waxay aragtaa meel aanay adeegin oo ay tuurtaa baakadda.

Ilaalinta OpenVPN laftiisu waxay daboolaa hal meel oo sax ah. Buugga 2.6 wuxuu --redirect-gateway ku sharraxayaa isku xigxig: wuxuu ku daraa waddo martigeliyaha peer-ka VPN iyada oo loo marayo irridda la isticmaalay ka hor tunnelka, si taraafikada sirta ah aysan ugu soo noqon gudaheeda, kadibna wuxuu beddelaa wadada caadiga ah. Waddadaas martigeliyaha waxaa loogu talagalay peer-ka oo keliya. Macmiilkaaga SSH waa uun cinwaan internet kale mana helo wax ka reebban.

Hal khalad horgale ah waa in hore loo reebaa. ip route add -net 0.0.0.0 gw 10.8.0.1 dev tun0 oo aan dherer lahayn wuxuu la mid yahay cinwaanka keliya 0.0.0.0, ma aha internetka; waa inuu noqdaa 0.0.0.0/0. Haddii qaadashada caadiga ay jebiso gaadiidka tunnelka laftiisa, ku dar barta dhammaadka sida waddo martigeliyaha iyada oo loo marayo interface-ka jireed, adigoo isticmaalaya cinwaanka dhabta ah ee bixiyaha.

Xidh cinwaanka macmiilkaaga SSH si degdeg ah loo hagaajiyo

Dayactirka ugu dhaqsaha badan waa waddo martigeliyaha cinwaanka macmiilkaaga oo loo marayo irridda uu serverku isticmaalay ka hor inta uusan tunnelku jirin. Dhinacaaga, hel cinwaanka uu serverku arki doono, kadibna akhri shaxda serverka si aad u ogaato irridda hore:

curl -s https://ifconfig.co
ip route

Serverka, ku dar ka reebbanida ka hor inta uusan macmiilku bilaaban. Cinwaannada halkan waa meelo bannaan; qaabka ayaa muhiim ah:

sudo ip route add 80.128.240.55 via 192.168.178.1

Kani waa dayactirkii loo isticmaalay kiiska la soo sheegay, wuuna isla markiiba shaqeeyaa. Wuxuu sidoo kale jilicsan yahay laba siyaabood oo la saadaalin karo: waddadu way lunto marka dib loo bilaabo, waxayna qaldamaan isla markii ISP-gaagu cinwaan kale ku siiyo. U qaado tallaabo degdeg ah oo si ula kac ah uga dhig mid waara, iyada oo loo marayo unug shabakadeed ama jillaab dispatcher, ama aqbal inuu ku meel gaar yahay oo qor wadada soo kabashada.

Ka jooji macmiilka inuu qaato wadada caadiga ah

Xulashada nadiifka ah waa in tunnelka aanu beddelin wadada caadiga ah gabi ahaanba. route-nopull, marka lala isticmaalo --client ama --pull, wuxuu aqbalaa xulashooyinka la riixay marka laga reebo waddooyinka, block-outside-dns iyo xulashooyinka nooca DHCP sida serverada DNS, marka waxaad ku darsataa oo keliya horgalayaasha aad u baahan tahay. Qalabka ka cidhiidhi ah waa shaandhada jiidista, oo tuurta hal tilmaam oo dhib leh oo haysta inta kale:

route-nopull
pull-filter ignore "redirect-gateway"

Isticmaal mid ama mid kale, ma aha labadaba, oo caddee waxa isbeddelaya. Iyada oo aan waddo caadi ah laga helin tunnelka, serverku mar dambe internetka kama baaro bixiyaha; wuxuu gaaraa oo keliya wixii aad si cad u martay. Haddii tunnelka buuxa uu ahaa ujeeddada dhan ee dhigista, kani waa furaha qaldan oo waddada martigeliyaha ee kor ku xusan ayaa sax.

U qaybi wadada soo noqodka isha ama xidhiidhka

Marka cinwaanka soo galaya uu xasilloon yahay, qaanuunka isha ayaa jawaabaha gudaha ku hayaa isagoon taaban waddooyinka tunnelka laftiisa. Siiso cinwaanka interface-ka jireed shaxdiisa oo leh horgalaha LAN iyo caadiga jireed, kadibna dooro shaxdaas taraafikada ka soo baxa:

ip rule add from 192.168.1.11 table 128
ip route add table 128 to 192.168.1.0/24 dev eth0
ip route add table 128 default via 192.168.1.1

Tani way shaqaysaa sababtoo ah jawaabaha xidhiidhka SSH ee soo galaya waxay ka soo baxaan cinwaanka uu macmiilku ku xidhmay. Kiiska la soo sheegay ee ay ahayd in adeeg kasta oo soo galaya uu sii shaqeeyo wuxuu isticmaalay isla qaabkan. Marka cinwaanka soo galaya uu dhexmaro ama waddadu tahay mid firfircoon, calaamadee xidhiidhka: saar calaamad conntrack baakadda ugu horeysa ee ka timaadda interface-ka jireed, ku koobi baakadaha jawaabta OUTPUT, oo u marso baakadaha calaamadeysan shax tilmaamaysa irridda jireed.

iptables -t mangle -A PREROUTING -i eth0 -m conntrack --ctstate NEW -j CONNMARK --set-mark 1234
iptables -t mangle -A OUTPUT -m connmark --mark 1234 -j MARK --set-mark 4321
ip route add default via 192.168.1.1 dev eth0 table 3412
ip rule add fwmark 4321 table 3412

Kala hayso calaamadda xidhiidhka, calaamadda dab-damiska iyo lambarka shaxda inta lagu jiro tijaabada. Isticmaalka hal lambar laba door ayaa soo saara qaanuun u eg mid sax oo ku dhaca baakadaha qaldan. Qoraalka caadiga ah ee shaxda wuxuu sidoo kale u baahan yahay via oo la socda irridda LAN ee xiriirka Ethernet caadiga ah; dev eth0 qaawan wuxuu shaqeeyaa oo keliya marka interface-ku yahay dhibic-ilaa-dhibic ama boodhka xiga si kale loo xalliyo. Martigeliyaha Jessie ee la soo sheegay wuxuu ku sugnaa xiriir ay qaabka qaawan ku shaqeeyay, taasna ma aha qaanuun qaybin oo la koobi karo.

Hubi adigoon banaanka ku xidhmin

Ha tijaabin adigoo gooya. Fur fadhiga koowaad, kor u qaad tunnelka, oo kernelka weydii wadada ay cinwaankaagu qaadan lahaa:

ip route get 80.128.240.55

Jawaabtu waa inay sheegto interface-ka jireed iyo irridda hore, ma aha tunnelka. Kadibna fur xidhiidh SSH labaad; taasi waa tijaabada dhabta ah, sababtoo ah fadhiga hore wuxuu ku sii noolaan karaa xaalad uusan xidhiidh cusub soo saari karin. Haddii labaaddu lalmaadato halka koowaad weli jawaabto, qaanuunku marnaba kama soo horjeedin taraafikada muhiimka ah, calaamadaha ama cinwaanka ishaana waa meesha la eegayo.

Hayso konsole ka baxsan band inta lagu jiro tababarka oo dhan. Serverka wadada kaliya ee uu ku galo tahay tunnelka aad hadda jebisay laguma hagaajin karo tunnelkaas, dib u celintaana way fudud tahay marka aad qortay lambarrada shaxda iyo horgalayaasha aad ku dartay.